CVE-2023-49568
📋 TL;DR
A denial-of-service vulnerability in go-git versions before v5.11 allows attackers to crash go-git clients by sending specially crafted responses from malicious Git servers. This affects applications using go-git with filesystem operations, but not those using only in-memory filesystems. The vulnerability is specific to go-git and does not affect the official Git CLI.
💻 Affected Systems
- go-git
📦 What is this software?
Go Git by Go Git Project
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption for applications using go-git, potentially causing application crashes and unavailability.
Likely Case
Resource exhaustion leading to degraded performance or crashes of go-git dependent services.
If Mitigated
Minimal impact if applications use only in-memory filesystems or have updated to patched versions.
🎯 Exploit Status
Exploitation requires attacker to control or compromise a Git server that the go-git client connects to.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.11.0
Vendor Advisory: https://github.com/go-git/go-git/security/advisories/GHSA-mw99-9chc-xw7r
Restart Required: Yes
Instructions:
1. Update go-git dependency to v5.11.0 or later. 2. Run 'go get github.com/go-git/go-git/v5@v5.11.0'. 3. Rebuild and redeploy affected applications. 4. Restart services using go-git.
🔧 Temporary Workarounds
Use in-memory filesystem only
allConfigure applications to use only in-memory filesystem operations if possible, as these are not vulnerable.
Network segmentation
allRestrict go-git clients to trusted Git servers only using firewall rules.
🧯 If You Can't Patch
- Implement strict network controls to allow go-git clients to connect only to trusted Git servers.
- Monitor for abnormal resource consumption or crashes in applications using go-git.
🔍 How to Verify
Check if Vulnerable:
Check go.mod or go.sum for go-git dependency version. If version is below v5.11.0, the system is vulnerable.Check Version:
grep 'github.com/go-git/go-git' go.modVerify Fix Applied:
Verify go-git version is v5.11.0 or later in go.mod/go.sum and that applications restart successfully.📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes
- High memory/CPU usage in go-git processes
- Error logs mentioning go-git failures
Network Indicators:
- Connections to untrusted Git servers from go-git clients
SIEM Query:
source="application.logs" AND ("go-git" OR "github.com/go-git") AND ("crash" OR "panic" OR "out of memory")